Cosmos DB Trigger Azure Function getting triggered without having any inbound access

Question

We have created a Cosmos DB trigger azure function. In inbound traffic we have blocked public access and not configured any private endpoint. In outbound traffic we have configured same VNET as cosmos DB. Though we are not giving private access in inbound traffic of Azure function, it is getting triggered by Cosmos DB record updation.
How Function is getting triggered even though we have complete restriction in inbound traffic?

Answer 1

Debashis Jena Thank you for reaching out. From the description above looks like your Azure Function is getting triggered even though we have complete restriction in inbound traffic. Even if you have blocked public access and not configured any private endpoint for inbound traffic, the Azure Function can still be triggered by Cosmos DB record updating because the outbound traffic from Cosmos DB is configured to use the same VNET as the Azure Function. This means that the outbound traffic from Cosmos DB is allowed to reach the Azure Function, even though the inbound traffic to the Azure Function is restricted. Read more. Configure access to Azure Cosmos DB from virtual networks (VNet) Azure Functions networking options Please do comment below if you need additional clarifications. Regards, Oury